Canadian 'Digital Privacy' Bill Actually Puts Everyone's Privacy At Risk; Will Be A Boon To Trolls

from the no-anonymity dept

Michael Geist is raising the alarm on a dangerous new bill in Canada, called the "Digital Privacy Act" (Bill S-4), which will actually serve to undermine many people's privacy. Much of the bill is focused on security breach disclosure rules, something that is important and useful. But, with that are some hidden, and extremely problematic, sections as well.

In light of revelations
that telecom companies and Internet companies already disclose
subscriber information tens of thousands of times every year without
a court order, the immunity provision is enormously problematic. Yet
it pales in comparison to the Digital Privacy Act, which would
expand the possibility of warrantless disclosure to anyone, not just
law enforcement. Bill S-4 proposes that:

"an organization may disclose personal information without the
knowledge or consent of the individual... if the disclosure is
made to another organization and is reasonable for the purposes of
investigating a breach of an agreement or a contravention of the
laws of Canada or a province that has been, is being or is about
to be committed and it is reasonable to expect that disclosure
with the knowledge or consent of the individual would compromise
the investigation;

Unpack the legalese and you find that organizations will be
permitted to disclose personal information without consent (and
without a court order) to any organization that is investigating a
contractual breach or possible violation of any law. This applies
both past breaches or violations as well as potential future
violations. Moreover, the disclosure occurs in secret without the
knowledge of the affected person (who therefore cannot challenge the
disclosure since they are not aware it is happening).

Of particular concern is how this could be a huge boon for copyright trolls, who can get information from ISPs without a court order, by simply claiming that it's for the purpose of "investigating a breach of an agreement or a contravention of the laws of Canada." Similarly, this would put a serious chill on protections for anonymous speech, as claims of defamation or other issues might lead to quick revelations of anonymous commenters, without any role for a Canadian court to balance the interests of free speech and privacy.

It's difficult to see how a bill that is supposed to be about protecting people's privacy actually has this clause that will effectively decimate privacy for many individuals. Industry Canada insists that this provision is narrowly targeted, but Geist highlights how the government rejected much narrower constructions, and seems unable to comprehend how disastrous the current bill will be for Canadians' privacy.